Data protection information SEW-EURODRIVE

Thank you very much for your interest in the websites of SEW-EURODRIVE Polska Sp. z o.o., our mobile applications and our products and activities.

The protection of the privacy of your personal data is an important element that we take into account in our business processes. We therefore process your personal data taking into account the relevant data protection regulations, in particular the guidelines of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (‘GDPR’).

Below we provide you with information regarding the processing of your personal data by SEW-EURODRIVE Polska Sp. z o.o.. Depending on the ways and purposes for which we process your personal data, only selected information shall be applicable to you.

The Controller of the personal data of you is SEW-EURODRIVE Polska sp. z o.o. with its registered office in Łódź, ul. Techniczna 5 92-518 Łódź, entered in the Register of Entrepreneurs kept by the District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register under National Court Register number: 0000079236, NIP (Tax ID): 7261678845, REGON (Business ID): 471388462 (hereinafter referred to as ‘SEW-EURODRIVE’ or ‘Controller’).

You can contact us in relation to data protection and the exercise of your rights, using:

• contact form on the website at: www.sew-eurodrive.pl
• contact phone: +48 42 270 90 00
• sending a letter to our address: SEW-EURODRIVE Polska Sp. z o.o., ul. Techniczna 5, 92-518 Łódź

The Controller has appointed a Data Protection Officer. This is Ms. Katarzyna Lamczyk. You can contact her regarding data protection issues and the exercise of your rights by email: rodo@sew-eurodrive.pl or by sending a letter to the mailing address indicated above.

I. What is personal data

II. Information for users of our websites and mobile applications, including a ‘cookie policy’

III. Purposes and means of processing data of customers and users of the SEW-EURODRIVE websites

IV. Data protection information for suppliers and subcontractors

V. Purposes and uses of employee candidate data at SEW-EURODRIVE

VI. Data protection information for visitors to SEW-EURODRIVE

VII. Data protection information in the context of data processing in the context of trade fairs or other events

VIII. Data protection information regarding the taking and publication of photos, sound and video recordings as well as press releases and advertising texts

IX. Data protection information in the context of using Microsoft Teams as a collaboration platform

X. Data protection provisions in the context of the use of Cisco Webex

XI. Data protection information in the context of video surveillance

XII. Data subjects' rights

I. Definition of personal data

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, your name, surname, contact details including telephone number or e-mail address, as well as any information about you that we process in connection with the relationship between us.

When you use our website or mobile application, we may process personal data such as your name, surname, contact details (both business and private), address. In addition, we may collect other information that may constitute personal data, such as your IP number, connection data or the sources you use. The latter data are generally obtained through the use of logfiles and cookies.

In relation to the application, personal data includes, for example, your surname, contact details (business and private), address, interests or legal and tax status. We consider all information you provide to us as application-related data, including your resume, your photograph, if any, and other private information.

II. Information for users of our websites and mobile applications, including a ‘cookie policy’

Below you can find information about how we process your personal data in connection with your visit to our website and other forms of online contact with us, including what types of personal data we process, for what purposes and to what extent.

II. 1. Processing of our website users' data

When you access our website, general information is automatically collected. This information (server logs) includes: type of Internet browser, operating system used, domain name of your Internet service provider, etc. In addition, we may use your IP address for the performance of the service you have selected. The collection of this information is technically necessary and essential for the correct delivery of content on our websites. In addition, we need this data to ensure that the website is available at all times. After a few weeks, your personal data shall be anonymised or deleted by us unless we have other grounds for processing it, for example if one of the following situations occurs:

• you send us an enquiry by email – in this case we shall process your personal data for the purpose of responding to your enquiry. The legal basis for the processing in this case is Article 6(1)(f) of the GDPR.
• you use the services offered on our websites ─ in this case we shall process your personal data to the extent that it is necessary for the performance of these services. The legal basis for the processing is Article 6(1)(b) of the GDPR.

If one of the situations described above occurs, in particular if you provide us with data in connection with entering into an agreement with us or registering on our website, please read the data protection information set out in section III.

Further processing of your data by us or other companies of the SEW-EURODRIVE Group or external service providers beyond the purposes indicated above takes place depending on the use you have chosen for your data, as set out below, or if you have given your consent.

II. 2. General enquiries and business correspondence via the online contact form

In addition to contacting us by telephone and e-mail, you can also use the online contact form to send us your general enquiries about us or our products and services. We process the data that you have entered in the form on our servers in Bruchsal. The form includes required information, which we need in order to process and respond to your inquiry, as well as largely voluntary information that you enter voluntarily in the free text fields. The data is as follows:

• E-mail address (required information)
• Postal code (required information)
• Subject of your inquiry (voluntary)
• Content of your message (voluntary)
• Academic title (voluntary)
• Customer number (voluntary)
• Name, surname (voluntary)
• Company name (voluntary)
• Street name, house number, town/city (voluntary)
• Country/region (voluntary)
• Telephone number (voluntary)
• Telephone extension (voluntary)
• Cell phone number (voluntary)
• Attachments that you upload via the form (voluntary)

We process and store data to the extent and for the duration necessary for the purposes of compiling a response to your request and/or complying with data retention obligations.

The legal basis for requesting and processing required information is Art. 6(1)(a) of the GDPR. We require this information, such as your e-mail address and postal code, to enable us to automatically forward your inquiry to the relevant internal department and to process and respond to your inquiry. In this respect, the collection and processing of this required information is in your interest.

The legal basis for processing the information that you enter on a voluntary basis in the free text form fields is Art. 6(1)(f) of the GDPR. The controller's legitimate interest in this case is the processing of the data indicated on the contact form for the purpose of responding to your enquiry. By voluntarily entering this information in the online form, you express that the processing of this information is in your interest and that you knowingly wish it to be processed. In this respect, the processing is in your interest.

The legal basis is Art. 6(1)(b) of the GDPR if your details and the correspondence between you and us is necessary so that you as an employee of our customers, suppliers or other third parties are able to do your job and contact us in a business capacity, for example, to order products and services or to report a support case if you are an existing customer.

II. 3. General guidelines for security online and on external links

We take technical and organisational security precautions on our websites to protect personal data stored by us against access by third parties, loss or misuse, and to enable secure data transfer.

Nevertheless, we encourage you to be vigilant when using the Internet and e-mail, as despite the security measures taken when transferring information, unintentional access to data by third parties may occur. Please remember that you are also responsible for the adequate protection of your data.

Our websites may contain links to other websites of third-party providers, the privacy or content of which is the responsibility of the owners of these websites.

II. 4. Online Support

On our website, you have the option to register and create an individual customer account on our Online Support website, which gives you access to online support, including consultations, the ability to place orders, track deliveries, order troubleshooting and other SEW-EURODRIVE functions and services. In such cases, the legal basis for processing your data and the purpose and scope of the processing shall vary depending on the individual functions or services ordered. If you create a customer account on the website, the basis for processing your personal data is Article 6(1)(b) of the GDPR.

In addition, we may also process your data for other purposes, for example to optimise our online support platform and to improve your experience as a user (known as a user experience). In that case, the basis for the processing may be our legitimate interest (Article 6(1)(f) of the GDPR) or your consent (Article 6(1)(a) of the GDPR). You can find more information about the processing of personal data for these purposes in sections II and III.

II. 5. Advertising mailings

If you have given your prior consent (e.g. by means of a form), we shall send you information about our products and services by e-mail.

Notwithstanding the above, we may send you promotional and marketing information such as information about trade fairs, products and services by post to your postal address unless you have objected to receiving such correspondence. For more on the use of your personal data for advertising purposes, please see section III.1.

You may revoke your consent to receive advertising mailings or object to the use of your data for advertising purposes sent to your postal address at any time. For the purpose of revocation, please contact us by telephone, e-mail or via the form.

II. 6. Mobile apps

We offer you access to our mobile applications available in the Apple App Store and Google Play Store. When you download these apps, your personal data such as your username, e-mail address and account number, the time of download, payment information and your individual device identifier shall be transmitted to the online shop. In addition, the online shop may, as an independent controller of the personal data, collect other data of yours and share the results of the analyses, which is beyond our control. In order to review the scope of data processing by the online shop, we recommend reading the privacy policy of the shop from which you intend to download our app.

When using mobile applications, we process your personal data only to the extent necessary to download the mobile application to your end date and to use the functions of the mobile application and to ensure its stability and security.

In addition, the processing of data such as device identification, unique end device number (IMEI = International Mobile Equipment Identity), unique network user number (IMSI = International Mobile Subscriber Identity), mobile phone number (MSISDN), MAC address for WLAN use, the name of your mobile device, e-mail address, if required to provide the functions you have requested, may be necessary for the execution of all functions of the application. The legal basis is the conclusion of an agreement, i.e. Article 6(1)(b) of the GDPR.

II. 7. Information on the use of technical means (‘Cookie Policy’)

Below are the cookies and tools used on our website:

Information on the use of technical aids (in particular cookies)

Our website (and some of our applications) use technical aids that perform various functions, in particular what are known as cookies. Cookies are small text files stored on your terminal device which are saved by your Internet browser. They serve to make our services more user-friendly, more efficient and more secure. We use both so-called temporary (session) cookies, which are deleted when you close your browser (‘Session Cookies’), and persistent cookies.

When visiting our website (or using the app) and at any later point in time, you have the option of choosing whether or not to authorise the use of cookies or individual additional functions. You can make changes in your browser settings or via our Cookies Control Panel. If you choose to reject the use of cookies, you may not be able to make full use of our services.

In the context of the use of cookies, we distinguish between cookies that are absolutely essential (for the display and operation of the website) and cookies for other purposes, such as anonymous measurement of the number of visits (functional cookies) and marketing cookies (advertising purposes, display of relevant and personalised content). The various purposes of processing and the specific services used are outlined below, and the data processing involved is described.

a) Essential cookies

These are so-called session cookies which allow us to recognise you when you visit the website as part of a single session. Session cookies contribute to the safe use of the website, e.g. by enabling the Online Support function. If cookies collect personal data, e.g. the IP number of your device, the legal basis for processing is Article 6(1)(f) of the GDPR. The aforementioned purposes of using necessary cookies constitute our legitimate interest in processing the data.

b) Voluntary cookies

With your consent, we shall use functional and marketing cookies. With functional cookies, we can use the tracking functions we use, which allow us to analyse the use of our website and improve its performance. We use the following tracking functions:

etracker

This is a tool used to compile statistics on the use of our website. The provider of the tool is etracker GmbH with its registered office in Hamburg / Germany ( www.etracker.com). If you give your prior consent, this tool may occasionally use functional cookies that allow us to statistically analyse the use of our website by visitors and to present marketing content. Data that can identify an individual, such as IP address, registration or device identifiers, shall then be pseudonymised or anonymised as soon as possible. We may also occasionally use the etracker tool as an option without the use of cookies. In this case, we shall not use personally identifiable information about the user.

The personal data processed by etracker is stored in the European Union in accordance with our guidelines and is thus subject to European data protection laws and standards. etracker does not process data for its own purposes and has been independently assessed for compliance with EU data protection standards and has been certified and awarded the ePrivacyseal data protection seal.

Data processing in etracker takes place on the basis of Article 6(1)(a) of the GDPR, i.e. your consent. However, in the option without the use of cookies, the basis for the processing is Article 6(1)(f) of the GDPR, i.e. our legitimate interest in conducting statistical analyses of the use of our website and statistics for the purpose of ensuring regular optimisation of our online offer and website, so that our website is more interesting for users. You may object at any time to the processing described here, insofar as it is carried out on the basis of personal data. For more information on data protection at etracker, please follow the link.

Statistics tool

We also use our own internally developed tool that enables us to conduct analyses on the use of our website and Online Support.

If you remain not logged in to our website, we shall not identify you from the data and information you have provided. We shall then place cookies in the browser of your terminal device (e.g. computer) and assign a random session ID. The cookies shall also contain the following information about your device:

• screen size
• screen resolution
• type of device
• operating system and version
• browser
• information as to whether cookies are activated in the browser
• geo data (continent, country, region, city)
• timestamp (date, time of login)
• ‘click data’ (individual applications accessed)
• search queries
• ‘abandoned shopping carts’ (product placed in the shopping cart but not ordered)
• bandwidth and Internet provider

We shall analyse the above information in order to be able to assess whether and how non-logged-in users make use of our Online Support offer.

However, if you log in to Online Support, we shall additionally use the following data for analytical purposes:

• your role at the company
• registration date
• name of company, entity, account number
• type of company
• order designation
• net price entitlement
• sales organization

This tool does not use your name, surname and IP address. The data collected by this tool shall only be processed for the purpose and to the extent necessary for the analysis and optimisation of Online Support. The information collected and analysed is not passed on to third parties outside the SEW Group and is stored exclusively on our servers located in the European Union. The duration of their storage and processing is up to 5 years.

The legal basis for the processing is Article 6 (1)(f) of the GDPR. The above-mentioned purposes of using the tool constitute our legitimate interest in processing the data.

If you do not wish analysis when using the Online Support tool via your terminal device, please object to the tracking by clicking here.
Opt-out successful.

Functions for advertising purposes

Below is an overview of the functions that shall be performed by us, with your consent given at the beginning of your use of the website. These are functions that are used for advertising purposes and use marketing cookies for this purpose.

For marketing purposes, we use functions that use cookies, for example to tailor advertisements to the interests of the website visitor. They are also used to limit the frequency of impressions and to measure the effectiveness of impressions.

Marketo

On our website, we continue to use the service of Marketo Inc (‘Marketo’). Thereby cookies are used, which are saved on your end device and which enable an analysis of your use of the website.

For this purpose, we create a pseudonymised profile of you, whereby your IP address is anonymised. We then analyse your use of our website based on your interests, adjust the advertising content presented to you and regularly optimise our online offer and website content to make it increasingly interesting for you as a user.

The information generated by cookies about your use of this website is transmitted to and stored on a Marketo server located in the EU. For the purpose of safeguarding these functions, the Cloudflare service is also used, which controls the various certificates for Marketo, e.g. the SSL certificate, and distributes the load of requests to the various servers in order to increase the security or performance of the websites (Load Balancing).

In individual cases, advertising application data may also be transferred to and stored on servers in the USA. In these cases, Marketo has imposed a standard equivalent to the former EU-US Privacy Shield. In addition, we have agreed with Marketo and Cloudflare so-called standard contractual clauses, the purpose of which is to ensure compliance with an adequate level of data protection in a third country.

The processing of personal data for the purposes of Marketo functions is based on your consent in accordance with Article 6(1)(a) of the GDPR.

You may withdraw your consent to the processing of your data at any time (without affecting the admissibility of the processing up to that point) by selecting the function in the Cookies Control Panel.

LinkedIn Insight Tag

Our website uses the LinkedIn Insight Tag (or LinkedIn Pixel) of the LinkedIn Ireland Unlimited Company (‘LinkedIn’). By enabling this JavaScript tag, you, as a user of our website, may be shown interest-based advertisements (‘Ads’) relevant to you when you visit LinkedIn's social network or other websites that also use this procedure, and we receive visitor statistics and demographic data. In addition, we may assess your use of our LinkedIn advertising and your interest in our offers, also using conversion tracking, and display retargeting information on other websites.

By enabling the LinkedIn Insight Tag, your browser automatically establishes a direct connection to the LinkedIn server, both when you visit the LinkedIn website and websites that have installed the LinkedIn Insight Tag. LinkedIn and we are jointly responsible for collecting your usage data when you visit our website and transmitting it to the service provider. However, once the data has been transmitted, LinkedIn is solely responsible for the relevant processing for the purposes described. We have no influence on the extent and manner of LinkedIn's use of your data and therefore inform you to the best of our knowledge: By activating the LinkedIn Insight Tag, LinkedIn is informed that you have accessed the relevant webpage of our website or clicked on an advertisement originating from us. If you are registered on LinkedIn, the link can be assigned to your account. Even if you are not registered on LinkedIn or have not logged in, it is possible that the service provider shall know your IP address, time window and other identifiers and associate them with activities related to you.

Deactivation of the LinkedIn Insight Tag and other advertising disclaimers is possible in the advertising settings on the website and additionally at the address.

Further setting options and information about LinkedIn Insight Tag can be found in the LinkedIn Privacy Center.

The legal basis for the processing of your data for the purpose of LinkedIn Insight Tag is your consent, given in accordance with Article 6(1)(a) of the GDPR. You can withdraw your consent at any time, most easily by selecting the relevant function in our Cookies Control Panel.

LinkedIn also processes your personal data in the US and has imposed a benchmark, which is equivalent to the former EU-US Privacy Shield. We have also agreed on standard contractual clauses with LinkedIn, the purpose of which is to ensure an adequate level of data protection in the third country.

For more information on LinkedIn's data processing, please contact the service provider, LinkedIn Ireland Unlimited Company, Attn: Legal Dept. (Privacy Policy and User Agreement), Wilton Plaza, Wilton Place, Dublin 2, Ireland; LinkedIn Insight-Tag Information; Privacy Information.

YouTube

On the individual pages, we have integrated YouTube videos which are stored on our SEW-EURODRIVE Polska - YouTube website and can be played directly. They are integrated in ‘enhanced data protection mode’, i.e. no data concerning you as a user is transferred to YouTube if you do not play the videos. Only during the playback of the videos is your data referred to below transferred. We have no influence over this data transfer.

When playing the embedded videos, YouTube is informed that you have called up the corresponding page of our website. In addition, further data may be transferred to YouTube of which we are not aware. This takes place regardless of whether YouTube provides a user account with which you are logged in or whether no user account exists. Once you are logged in to YouTube, your data shall be directly assigned to your account. If you do not wish to have your YouTube profile assigned, you must log out before activating the button. YouTube stores your data as user profiles and uses them for the purpose of advertising, market research and/or the development of its website as required. Such analysis may be carried out in particular (even for non-logged-in users) for the purpose of implementing tailored advertising and to inform other YouTube users of your activities on our website. You have the right to object to the creation of these user profiles, for which purpose you must address your request directly to YouTube.

YouTube also processes your personal data in the USA and has imposed a benchmark corresponding to the former EU-US Privacy Shield. For more information on the purpose and scope of data collection, further processing and safeguarding of data transfers to third countries, please refer to YouTube's privacy policy. There you are provided with further information about your rights and setting options to protect your privacy. The legal basis for the processing of your data for the purposes set out in this document is your consent in accordance with Article 69(1)(a) of the GDPR. You can withdraw your consent at any time, most easily by selecting the relevant function in our cookie settings.

II. 8. Google Maps

Our website uses the Google Maps map service offered by Google Inc. via an API. In order to use the Google Maps functions, it is necessary to process your IP address and other usage data. This information is generally transmitted to a Google server in the USA and stored there. We have no influence over this data transmission. Google may combine your usage data with other data and, if you are logged into your Google account, associate it with your account. The use of Google Maps serves to present our online offers attractively and to easily identify the places we have indicated on the website. The legal basis for the processing of your data is Article 6(1)(f) of the GDPR. The aforementioned purposes of using the tool constitute our legitimate interest in processing your data.

For more information on the processing of your user data, please refer to Google's privacy policy.

II. 9. SEW-EURODRIVE profiles on social networks

a) Facebook Fanpage

For the information services offered here, we use the technical platform and services of Facebook Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland. We wish to inform you that use of our Facebook page and its functions takes place under your own responsibility. This applies, in particular, to the use of interactive functions (e.g. Comment, Share, Rate).

When you visit our Facebook page, Facebook records, for example, your IP address and other information available in the form of cookies on your terminal device. This information is used to supply us as the provider of the Facebook pages with statistical information about the use of our Facebook page (so-called Facebook ‘Insights’). Facebook provides further information via the following link.

The data collected in this connection is processed by Facebook Ltd. and, if necessary, transferred to countries outside the European Union, in particular to the United States. Your data may be transferred to the USA, in which Facebook, according to its own statement, maintains an adequate level of data protection equivalent to the previous EU-US Privacy Shield.

Facebook has its guidelines in which it describes information on how your data is used. There, you can also find information on how to contact Facebook and on your advertising settings. The full data use guidelines can be found at the following link. Information on how to manage or delete the information you have can be found on the Facebook support pages.

The manner in which Facebook uses data when you visit Facebook pages for its own purposes, the extent to which activities on the Facebook page are attributed to individual users, how long Facebook stores this data and whether data from your visit from the Facebook page is passed on to third parties, has not been explicitly and clearly defined by Facebook and is not known to us. Facebook's data processing may vary depending on whether you are registered and logged in to Facebook or whether you visit the website as an unregistered and/or unlogged user.

When you access the website or post on Facebook, the IP address assigned to your terminal device is transmitted to Facebook. According to Facebook, this IP address shall be anonymised and deleted after 90 days. Facebook also stores information about its users' terminal devices (e.g. as part of the 'Registration notification' function). If necessary, Facebook allows you to assign IP addresses to individual users. If you are currently logged in to Facebook as a user, a cookie with your Facebook ID is stored on your terminal device. This allows Facebook to track that you have visited a particular page and how you have used it. This also applies to all other Facebook pages. Facebook buttons embedded on websites enable Facebook to record your visits to these websites and to assign them to your Facebook profile. This data allows us to offer content or advertising tailored to your needs.

If you wish to avoid or limit the data processing by Facebook described above, you should log out of Facebook or deactivate the ‘stay logged in’ function, delete the cookies on your terminal device and restart your browser. This deletes information from Facebook that can directly identify you. This allows you to use our Facebook page without revealing your Facebook ID. When you access the interactive functions of the website (likes, comments, sharing, message, etc.), the Facebook login screen appears. Once you have logged in, you are again recognised by Facebook as a specific user.

We, as the service provider of the information service, only process data about the use of our website on Facebook that you provide to us and that require interaction. If you ask a question that we can only answer via e-mail, we shall store your information in accordance with the general data processing rules that we describe in this privacy policy. The legal basis for the processing of your data on our profile on Facebook is Article 6(1)(f) of the GDPR. The aforementioned purposes of using the Facebook constitute our legitimate interest in processing your data.

For the purpose of exercising your data subject rights, you can contact both us and Facebook. If one of the parties is not responsible for responding, or if the information must be obtained from the other party, then we shall forward the enquiry to the concerned partner or to Facebook. For questions regarding profiling, processing of your data when using the Website and Insights, please contact Facebook directly (link see above). For questions regarding the processing of your interactions with us on our website, please send a message to: rodo@sew-eurodrive.pl.

If you have any questions about our information offer, please contact us at the contact details listed above. The concept behind the offer can be found at the following web address.

b) Presence on other social media platforms

We also have a presence on the following social media, run by other service providers:

To provide these information services, we access the providers’ technical platform and services. We hereby inform you that use of our sites on social media platforms and their functions is at your own risk. This applies, in particular, to the use of interactive functions (e.g. Comment, Share, Rate). When you visit our pages, the social media platform providers record, among other things, your IP address as well as additional information found on your PC as cookies. This information is used to supply us as the provider of the accounts with statistical information about the interaction with us.

The details relating to Facebook described above also apply here. In particular, your data may be transmitted to the USA; all of the above providers state that they comply with a reasonable level of data protection which corresponds to the former EU-US Privacy Shield. We do not know in what way the social media platforms use the data from your visit of our account and from the interaction with our contributions for their own purposes, for how long they store this data and whether they pass on the data to third parties. Data processing may vary depending on whether you are registered with, and logged into, the social network, or whether you access the site as a non-registered and/or not logged in user. When you access a contribution or the account, the IP address assigned to your end device is transmitted to the provider of the social media platform. If you are currently logged in as a user, a cookie on your end device can be used to track how you surfed the internet. If you want to avoid this, you should log out, delete any cookies on your device and restart your browser.

In addition to this, we as the provider of the information service only process the data from your use of our service which you provide and which requires interaction. For example, if you ask a question which we can only answer by e-mail, we will save your information in accordance with our General Data Protection Principles, as described in our Data Protection Information. The legal basis for processing your data on the social media platform is Article 6(1)(f) of the GDPR. The aforementioned purposes of using social websites constitute our legitimate interest in processing the data.

You can contact either us or the provider of the social media platform to exercise your rights as the data subject. If a party is not responsible for providing a reply, or must receive information from the other party, we or the provider of the social media platform will forward the query to the relevant other party. Please contact the provider of the social media platform directly for any queries concerning setting up your profile or the processing of your data when using the website. If you have any questions regarding how we process your interaction with us on this site, please do not hesitate to contact us at rodo@sew-eurodrive.pl.

In their data protection policies, the providers describe what information the social media platform receives and how this is used (see table above for the link). These also provide information about how to contact them and how to change your advertising settings.

II. 10. Registering, ordering and downloading other online services and offers

On our websites, we also offer services such as downloading white papers, ordering tickets to trade fairs, registering for online events and newsletters. To provide these offers and services, we use solutions and services from Marketo. In this context, please also refer to Marketo's Data Protection Provisions (section II. 7 of the Policy).

a. Ordering a trade fair ticket

If you wish to visit us at a trade fair, you can order your ticket directly online. The information that you enter in the form is transferred to us. In particular this is:

• name, surname (required information)
• e-mail address (required information)
• company name (required information)
• your department (required information)
• your position in the company (required information)
• street name, house number, postal code, city/town (voluntary)
• academic title (voluntary)
• country/region (voluntary)
• industry (voluntary)
• telephone number (voluntary)
• cell phone number (voluntary)

For the purpose of processing your order and delivering your ticket to the fair, as well as providing you with a suitable SEW contact person to answer your questions on the day of the fair in place, we require you to provide the information marked as required. The legal basis in this context is Article 6(1)(b) of the GDPR. In the event of the assertion or defence of claims, we may also process the above data on the basis of the controller's legitimate interest, i.e. on the basis of Article 6(1)(f) of the GDPR.

We process and store the data to the extent and for the duration required for the purpose of processing the ticket order and fulfilling the purpose.

b. Downloading information materials (e.g. white papers)

We offer information material (e.g. White Paper) on various topics and SEW-EURODRIVE products for free download from our website so that you can get to know us and our products better (special offer).

The information that you enter in the form is transferred to us. In particular this is:

• e-mail address (required information)
• academic title (voluntary)
• name, surname (voluntary)
• company name (voluntary)
• street name, house number, postal code, city/town (voluntary)
• industry (voluntary)
• department, position in the company (voluntary)
• telephone number (voluntary)
• cell phone number (voluntary)

Your e-mail address is essential for us to be able to send the information materials by e-mail. This is our legitimate interest. The legal basis is Art. 6(1)(f) of the GDPR.

We process and save the data to the extent and for the duration necessary to fulfil the purpose.

The legal basis for processing the information you provide voluntarily is the controller's legitimate interest in connection with your consent to receive commercial information, as well as Article 6(1)(f) of the GDPR. By entering the information voluntarily, you indicate that you are in agreement with the data processing described here, i.e. that you have an interest in the processing.

We may forward this data internally to our Sales department so that our Sales department can contact you.

c. Webinars and online events

We offer webinars and online events on our website. We process the information that you enter in the form. In particular this is:

• name (required information)
• surname (required information)
• e-mail address (required information)
• company name (required information)
• department (required information)
• position (required information)
• acad. title (voluntary)
• country/region (voluntary)
• industry (voluntary)
• telephone number (voluntary)
• cell phone number (voluntary)

The information marked as required information is essential in order to conduct the webinar or online event. For example, we need your e-mail address, your name and surname, department and position in the company in order, for example, to send you an invitation link by e-mail and send you the most appropriate information possible. This is also our legitimate interest. The legal basis is Art. 6(1)(b) of the GDPR.

Furthermore, we process and save the data to the extent and for the duration necessary to conduct the webinar or event.

The legal basis for processing the information you provide voluntarily is the controller's legitimate interest in connection with your consent to receive commercial information, as well as Article 6(1)(f) of the GDPR. By entering the information voluntarily, you indicate that you are in agreement with the data processing described here, i.e. that you have an interest in the processing.

III. Purposes and means of processing data of customers and users of the SEW-EURODRIVE websites

III. 1. Scope and purpose of data processing

a) Performance of the agreement

SEW processes data that it receives from you in the context of request for quotation or existing contractual relationships. In particular, this applies to e-mails, orders, suggestions for our products or billing data. The processing of your data is carried out on the basis of Article 6 (1)(b) of the GDPR. If a business relationship exists, you are obliged to provide personal data which is necessary for the preparation or execution of the agreements or which we are legally obliged to process. Otherwise, we cannot perform these agreements.

We process the information indicated below, which we may receive from you, using our local CRM systems located in Bruchsal. In addition, we use cloud solutions offered by a third-party provider with a data centre located in the European Union.

The scope of the processed information may include: surname, name, nickname, form of address, academic title, e-mail address (business), telephone and fax number (business), selected language of communication, content of expressed marketing consent, date of creation and modification of the entry and change history of the entry in the CRM, overview of interactions (telephone calls, visits, meetings, etc.), overview of incoming and existing orders, your function / role within the company.

In addition, we may process such information as:

• the content of the power of attorney or the scope of your authority to act on behalf of the company; which also applies to our subjective assessment of your presumed authority to represent the company and make decisions on its behalf,
• your position and decision-making capabilities within the company; i.e. on the basis of your function and the implied or documented scope of your authority, we determine, subjectively on the basis of our internal methodology, your position and decision-making capabilities within the company,
• level of activity, which means that the more often your surname appears in orders, offers, complaints, service requests, tickets, the higher your activity level is valued by us,
• preferred form of contact,
• your perception and evaluation of SEW, which refers to our subjective assessment of how you perceive SEW-EURODRIVE as a company,
• contact person at SEW-EURODRIVE,
• project organisation chart,
• your association, as the contact person, with leads and business opportunities,
• your association as a contact person with a customer of SEW-EURODRIVE together with your business address,
• URLs to your profiles on social media platforms,
• information from the Online Support platform including service tickets,
• definition of campaigns and target groups to which we assign customers internally

We process this information for the purpose of customer service and more efficient assignment and order processing. Our service employees need this data to contact you and to remedy the possible malfunction. In this respect, the processing of this information is necessary so that you and our employees can carry out your job smoothly. Data processing in the context of the execution of the agreement includes the use of data for the performance of the services covered by the agreement, including the provision of maintenance services under maintenance agreements or the fulfilment of any warranty claims. In addition to this, in the context of financing enquiries, SEW may use the data necessary to provide an offer and, if necessary, pass this on to its business partners. Further details of the purposes can be found in the relevant contractual documents.

The legal basis for the described data processing is primarily the execution of the agreement on the basis of Article 6(1)(b) of the GDPR. Insofar as it goes beyond the performance of contractual obligations, the basis for the processing is Article 6(1)(f) of the GDPR. The aforementioned purposes represent our legitimate interest in data processing.

External attorneys, tax advisors and auditors may access the information and documents necessary to perform their professional consulting and auditing services that relate to our business collaboration. In order to protect the data subjects and our IT systems from cyber attacks and hackers, we do not publish the names of the external system providers directly, instead, on request, we will provide you with the (company) names of the external recipients. The data centres of SEW-EURODRIVE and the external cloud providers are located in the EU. Access to the data in the CRM is also granted to persons from sales and customer support for the purpose of processing business transactions, as well as to the persons who maintain our IT and cloud systems and provide support services. We have either entered into data processing entrustment agreements with external providers or we transfer data to them on the basis of applicable legislation.

SEW processes and stores your data (within local systems as well as in an external cloud) to the extent and for as long as necessary in the context of the conclusion, execution and termination of the business partnership and to the extent and for as long as necessary for the assertion and exercise of rights or defence against claims (e.g. delivery, payment, guarantee, compensation) or to the extent and for as long as tax, accounting and bookkeeping periods and obligations require. Thereafter, data that is subject to a retention obligation under legal (e.g. tax) regulations is archived and deleted after the expiry of this obligation. All other data is deleted directly, unless there are other uses of the data indicated in this statement. The processing of the data takes place with regard to warranty claims on the basis of Article 6(1)(b) of the GDPR and for the purpose of fulfilling legal obligations pursuant to Article 6(1)(1)(c) of the GDPR. As regards the remaining scope, including for the purposes of asserting and exercising rights or defending against claims, the legal basis for the processing is Article 6(1)(f) of the GDPR and the purposes indicated constitute our legitimate interest.

b) Verification of address and credit worthiness

To verify your address and credit rating, SEW accesses databases from external agencies in order to gather address details and credit data about your company, including data that was calculated using statistical methods (scoring). This is done as long as SEW is undertaking a commercial risk in concluding the agreement and seeks to safeguard itself through this credit check. We can use the services of professional entities (credit agencies) to assess creditworthiness.

The information provided by the agencies and the internal information regarding payment behaviours is internally evaluated by SEW, which then creates its own rating for use as the basis for granting a credit limit. The credit data is deleted 5 years after the last delivery of goods. The processing of the data is carried out on the basis of Article 6 (1)(f) of the GDPR, on the basis of the Controller's legitimate interest, i.e. for the purpose of allowing you to provide goods or services while safeguarding SEW's economic interests.

c) Promotional use of data by SEW

SEW-EURODRIVE and engaged service providers (printing companies) use your name and address as a contact person in ongoing business relationships or of interested persons for additional measures for entering into and activating business partnerships. Advertising uses include sending advertisements for our products and services by post. Last but not least, we would like to stay in touch with you on special occasions and send you Christmas greetings, for example. SEW uses your telephone number or e-mail address for advertising purposes if prior consent has been given, based on Article 6 (1)(a) of the GDPR.

SEW may process your data obtained in connection with maintaining a business relationship (such as: contact details, information on products or services purchased) and when using offers/services on the website, trade fairs or other promotional activities for the purpose of profiling and preparing a personalised offer for you.

We may also send you – as an existing customer or if we have otherwise received your contact details - information in relation to special promotions, events or trade fair events by post within the framework described above. In this case, you will receive post from us with information about the specific campaign and how you can participate and what information you must issue us with. We will then often register your participation via an event-related website and process your data for the stated purposes indicated, for example to provide the products offered or send you information. We may use the information received as part of the processing described here. At the time of selection and sending of the initial information, your data is processed on the basis of a consideration of our interests, Article 6(1)(f) of the GDPR; when you participate in a campaign and register, your data is processed for the performance of the agreement, in accordance with Article 6(1)(b) of the GDPR.

As a rule, your data is saved in the EU for advertising purposes. Thereby we can use service providers whom we have carefully inspected and audited. Should data be transferred to and processed on servers in third countries outside the EU/EEA in individual cases, i.e. in particular the USA and, where applicable, the United Kingdom (UK), we use engaged and monitored service providers who have undertaken to guarantee an reasonable level of data protection and with whom the EU standard data protection clauses of the EU Commission have been agreed in principle. In individual cases, permission for data transfer may also arise under Article 49 of the GDPR, for example fulfilment of an agreement with an international focus or if you have issued your consent.

Personal data collected for advertising purposes shall be processed for as long as you remain our customer or express interest in our products or services. Exceptions are made if you consent to a longer period of usage and/or if the data is subject to statutory retention obligations. In the latter case, the data is deleted after the retention period specified by law has elapsed. The processing period may be shorter if you exercise your right to object, of which we inform you in Section V.

The legal basis for this promotional usage is Article 6(1)(1)(f) GDPR or, if you have given your consent, Article 6(1)(1)(a) GDPR. You have the right to object to the processing of your data, which we inform you about in section XII, which may result in shorter processing periods.

d) Processing of personal data due to legal obligations

SEW-EURODRIVE, like every other company in Poland and Europe, is subject to various legal obligations to verify the data of our customers and business partners. In such cases, we process your personal data only to the extent legally required. To fulfil these legal obligations, it may be necessary to process some of your data automatically in order to evaluate personal aspects, for example profiling. Unless you are expressly informed, no automated individual decisions are taken in connection with profiling. The legal basis for this processing is Article 6(1)(c) of the GDPR in conjunction with the applicable statutory provisions.

These statutory provisions relate to, in particular:

• prevention of fraud and money laundering
• tax auditing and reporting requirements
• evaluation and management of risks in the Group
• sanctions lists
• export control, customs regulations
• auditing, in particular by tax consultants and auditors

e) Scraping in publicly available sources to update the data in the CRM

Pursuant to Article 5 (1)(d) of the GDPR, the personal data processed must be ‘correct’ and ‘up-to-date’. We want to keep your contact data, which is stored in our database / our CRM (on our local servers and in the cloud), up-to-date at all times, so that in the framework of the services provided, both you and our employees can perform contractual obligations and correspond with each other smoothly.

To ensure data accuracy, we use automated scraping tools. Using this technology, we extract information from you and about you from publicly available sources and platforms such as e-mail signatures, websites, blogs, social networks (e.g. LinkedIN), (analogue and digital) business cards and import them into our CRM. Specifically, these are: form of address, surname, first name, business e-mail address, business phone number, business address, role and department in the company, company name, URL of your social media profile, Messenger URL, other information from business cards and e-mail signatures.

Access is granted to the people who have access to our CRM. At the moment, the information is extracted from public sources by SnapAddy, among others, and imported into our CRM (on premise and cloud). We have concluded a data processing agreement with SnapAddy. Our data centres, SnapAddy's data centres, and cloud providers are located within the EU. Since the information is imported into our CRM, the storage period is based on the storage period in the CRM (see section III.1(a) above).

We carry out the above activities on the basis of Article 6 (1)(f) of the GDPR. The aforementioned purposes constitute our legitimate interest in processing your data. In this case, you have the right to object to the processing of your data, see section XII for more information.

III. 2. Distribution of data within the SEW-EURODRIVE Group

SEW may pass on your master data (company name, contact persons, address and contact details such as telephone number and e-mail address) to other companies within the SEW-EURODRIVE Group and possibly update it in order to ensure that all SEW-EURODRIVE companies involved with you in a transaction (for example fulfilling an agreement) have access to the same personal data you have provided. This is intended to simplify our processes and may help you avoid having to provide the master data again when contacting another company within the SEW-EURODRIVE Group. The legal basis for this mode of data processing is Article 6(1)(f) of the GDPR. Our legitimate interest is to transfer data within the Group. If the transfer is made in the context of the performance of an agreement, the data shall be transferred on the basis of Article 6(1)(b) of the GDPR. Your rights are safeguarded by internal contractual policies that ensure a high standard of data protection.

Furthermore, in addition to the master data, other companies within the SEW-EURODRIVE Group may be provided with the information necessary to prepare an order. For example, different SEW-EURODRIVE products are manufactured by different SEW-EURODRIVE companies, so data may need to be transferred to simplify order processing and delivery. In such cases, you shall be informed of this transfer upon conclusion of the agreement. The legal basis for this processing is Article 6(1)(b) of the GDPR.

If your company is located outside of Poland, a subsidiary of the SEW-EURODRIVE Group competent for the registered office of your company may be responsible for managing and processing your agreements or enquiries. This company shall then process your personal data on the basis of the agreement concluded, i.e. on the basis of Article 6(1)(b) of the GDPR.

The processing procedures referred to above may result in your master data being processed by SEW-EURODRIVE companies outside of the European Union (EU) or European Economic Area (EEA). In cases where the EU Commission has not specified an reasonable level of data protection, we have made contractual commitments; generally, we have concluded the EU standard contractual clauses and checked the level of protection of the country in detail. You can find a list of the companies belonging to the Group here. This data is subject to the same retention and deletion rules as described above in the body of this privacy policy.

III. 3. Surveys with online tools

We may process your personal data in connection with carrying out surveys or polls with customers to find out as much as possible about the requirements of our customers as regards our products and services. We will therefore periodically ask you to take part in a survey, which is always voluntary.

When you take part in a survey, the information you provide is processed anonymously. In addition, we may store your personal data, such as your e-mail address, in order to invite you to participate in surveys, which we process independently of the survey results. We will also keep information that you have taken part in a survey in order to prevent multiple participation and thus possible falsification of the results; this information shall be stored separately from your participation information or your e-mail address and is not combined with other data.

If participants take part in the survey, participant responses are collected and analysed statistically. It is not possible to attribute responses to participants. In addition, we note the need to ask questions in a way that makes it impossible to establish an individual link to the respondent. We can partially link participation in the survey to competition or other bonuses, but this is only done in such a way that there is a separation between the answers and the bonuses, which means that it is not possible to link them to the answers. In addition, we can display individual design elements such as images, videos, questions or pages individually. When carrying out surveys and research, we use the SurvGo tool and the LamaPoll offer, both of which are provided by external service providers acting as our processing entities. These entities are appropriately verified by us (further information on data processing can be found in the supplier's Privacy Policy, Privacy Policy (survgo.com), Privacy Policy (lamapoll.de).

The legal basis for the processing of your contact data for advertising purposes is section III.1.(c) of this privacy policy. The legal basis for the processing of your data in the course of your participation in the survey is Article 6(1)(f) of the GDPR. Our legitimate interest is to obtain information about the company and our products that you may voluntarily provide to us.

IV. Data protection information for suppliers and subcontractors

a) Establishment, performance and termination of the supply agreement / transaction

SEW EURODRIVE procures goods and services from various suppliers and subcontractors around the world for the execution of both internal and external tasks, projects and transactions. In order to establish, perform and terminate these supply/support transactions and to carry out their professional tasks, it is necessary (purpose of the processing) for the employees of SEW EURODRIVE and the contact persons of the suppliers/subcontractors to exchange information by post, telephone or electronically, e.g. by e-mail, and to process and store this information in their respective analogue and digital supplier management systems and databases.

The following data is processed: name; surname; (business) e-mail address; telephone number; cell phone number; role in the company; delivery and postal address; information from quotations, order confirmations, contracts and invoices; your qualifications and certificates; the contents of the supplier's self-disclosure; notes from conversations; and information from our verbal, telephone or electronic correspondence.

SEW EURODRIVE processes the specified information in paper form and digitally on servers in Bruchsal (Germany). All data is processed according to the need-to-know principle. Auditors, tax advisors, lawyers, social insurance agencies and supervisory/investigative authorities shall have access to this information only to the extent and for the duration required by law and necessary for the fulfilment of their tasks. Access may also be granted to service providers who have been carefully selected and who are needed to properly manage the supplier relationship (e.g. supplier surveys, supplier audits, supply chain monitoring).

The data shall be stored only to the extent and for the duration necessary to establish, perform and terminate the services and to comply with legal, contractual or internal retention periods.

The legal basis for the processing is Article 6 (1)(b), i.e. for the purpose of entering into, carrying out and completing these supply/support transactions and (f) of the GDPR, for the exchange of information between SEW-EURODRIVE employees and supplier/subcontractor contact persons. The aforementioned purpose of the processing also constitutes our legitimate interest.

If the cooperation between suppliers and SEW EURODRIVE constitutes a data processing agreement or a joint controllership, we shall conclude corresponding agreements with these suppliers.

b) Supply chain monitoring and regular supplier surveys

EU regulations (e.g. EU Conflict Minerals Regulation 2017/821/EU from 17 May 2017) and both national (e.g. the German Supply Chain Act (LkSG)) and international (e.g. the U.S. Dodd-Frank Act of 2010) standards and laws regarding transparency require us to exercise due diligence in selecting our worldwide suppliers and to regularly review our supplier relationships, including the supply chains, on both a legal and ethical level. In addition to the applicable legal provisions, we observe our internal Code of Conduct in all SEW EURODRIVE subsidiaries worldwide. Key tenets of our corporate philosophy include respecting human rights worldwide, ensuring fair working conditions, combating corruption, mitigating armed conflicts, monitoring supply chains and protecting the environment.

We conduct annual supplier and supply chain surveys in order to prevent the use of conflict materials, conflict resources and conflict minerals in our supply chain (purpose of the processing). We conduct the surveys ourselves (see III. 3. Online enquiries) or commission the specialised service provider IntegrityNext GmbH from Munich (hereinafter IntegrityNext) for this purpose.

Section 1502 of the U.S. Dodd-Frank Act 2010 prohibits the use of so-called conflict materials. To complete the survey, we upload your company name and email address to the IntegrityNext platform and IntegrityNext then invites you to complete an inquiry on IntegrityNext platform. As part of the survey/inquiry, the following information is generally processed from you and about you: name, surname, (business) e-mail address, company name, and especially your entries in the questionnaire.

The data shall be stored in the (AWS) EU-data centres of IntegrityNext only to the extent and for the duration necessary to fulfil the purpose of processing and to comply with legal, contractual or internal retention periods.

The legal basis for the data processing is Art. 6(1)(f) of the GDPR. Our legitimate interest in surveying suppliers' employees—whether by us or external service providers—prevails, as this is the only way to uniformly inspect supply chains and materials to ensure that they are ‘conflict free’. This also constitutes our suppliers' interest.

V. Purposes and uses of job applicants data at SEW-EURODRIVE

If you apply at SEW EURODRIVE, the principles for data processing as described below apply. After hiring you, we shall inform you about data processing separately in the context of concluding the employment contract.

V.1. Scope of data processing and designated uses

a) Internal data processing when checking your application

We process the data provided as part of your application for the purpose of considering your application and suitability for the selected position. When checking your application for a position in Poland, we may possibly use specialised and supervised service providers. We require the following information to assess your application:

• name(s) and surname,
• date of birth,
• contact details,
• educational background,
• professional qualifications,
• employment history.

If you apply for a position at SEW-EURODRIVE in another country, additional information may be required (according to local law), such as:

• title (required),
• place of birth,
• identity and gender,
• nationality,
• residence or work permit,
• photo for job application / profile picture,
• postal and residential address (street, house number, postal code, town/city, country)
• e-mail address and telephone number (landline, mobile)
• diplomas (school, university) and references,
• educational and vocational training,
• certificates of further education and vocational training,
• your qualifications, language skills, personal qualities and other skills,
• your availability,
• preferred type of employment (full-time, part-time, freelance),
• references from previous employers,

The scope of data processed during the recruitment process may also include:

• information you provide and behaviour during the interview by telephone and/or held on site, e.g. educational and professional background, motivation to change places, career aspirations, desired location, remuneration expectations, strengths and weaknesses, your five-year plan, hobbies and voluntary work (if applicable), notice period with your current employer, goals for the future
• what you know about SEW-EURODRIVE and how you found out about SEW-EURODRIVE
• CV and a cover letter,
• telephone correspondence with comments/notes on the assessment form or notes in the HR system,
• other information contained in the application documents, in particular the curriculum vitae (CV)
• other information from online profiles on professional social media sites such as XING and LinkedIn,
• information provided to us by an external provider of HR services who has been commissioned to search for suitable candidates or who has been appointed by you to search for suitable positions or information about you that we exchange with the above-mentioned service provider (if applicable)
• consent to receive job alerts and professional information from SEW-EURODRIVE worldwide,
• information regarding reimbursement of travel expenses incurred during the job application process, such as account details,
• depending on the position, additional application questions may be requested in the job application assistant, some of which may be required,
• other data that are voluntarily provided by the applicant during the recruitment process.

If you apply via our careers (online) website (job application assistant) or if we contact you via a social media site, we shall process information about and from you in our own data centre , as well as in our cloud-based HR and recruitment system provided by Oracle. The Oracle data centre is located in Frankfurt am Main, Germany. The SEW-EURODRIVE headquarters in Germany has entered into a data processing agreement with Oracle for the purpose of protecting the information transferred and processed.

We shall forward your application internally to the department concerned.

We wish to point out that if you submit a foreign application, the HR and recruitment system is used by SEW subsidiaries worldwide. The subsidiaries are able to access your candidate profile, including contact details and application documents, via the candidate search.

If you have commissioned or we have commissioned an HR service provider to search for vacant positions / suitable candidates, we shall exchange the above information from you and about you with the aforementioned external HR service provider.

We shall delete the data contained in your job application 6 months after the end of the job application process (see section 3), unless you give us your consent to include it in our candidate database.

The legal basis for processing the above personal data is in accordance with Article 4(1) of the GDPR and, if applicable, special categories of data in accordance with Article 9(1) of the GDPR, Article 6(1)(b), Article 9(2)(b) and (e) of the GDPR.

If you are under 18, we require the consent of your guardians to conclude a contract with you. Even saving your application data for a longer period of time (e.g. for a work placement at a later point in time) is only carried out with your consent and the consent of your parent or legal guardian which is noted in the templates.

b) Adjustment to open job offers at the SEW-EURODRIVE Group

If you have given us your consent to do so, we shall check during the recruitment process whether you are eligible for positions other than the one you are currently applying for, and which match your qualifications. For the purpose of the comparison, we store your candidate data in a candidate database. If you do not wish such access at a later date, you can inform us of this at any time, in any form by e-mail or as described below (in section XII of this policy). An objection, irrespective of the time, obviously does not have any effect on the choice in the case of your current application. The processing of your data takes place on the basis of Article 6(1)(a) of the GDPR. Your rights are secured by internal contractual regulations ensuring a high level of data protection.

c) Saving your application in our talent pool

If you give the appropriate consent to the processing of your personal data for the purpose of taking part in future recruitments, your data shall be included in our candidate database. In this way, we can contact you when a suitable position becomes available. You can complete the job application form with the consent text here.

In the case of your consent, we store your recruitment data for no longer than 3 years. Please note that if you do not give your consent, we cannot consider you for future recruitment, for positions that may be suitable for you. The legal basis is Article 6 (1)(a) of the GDPR.

V.2. Applications via social media platforms

You can also apply to us using social media platforms (for example Linkedin). Data from the platform is redirected to a dedicated email address: praca@sew-eurodrive.pl in the form of your CV and any other documents you have provided via the platforms. We are not aware of any further details regarding the processing of your data by the platforms. The legal basis is Article 6 (1)(b) of the GDPR.

V.3. Career information and job notifications via email and social media, if applicable

If you agree on each issue, we shall regularly inform you by email about new vacancies at SEW-EURODRIVE worldwide (job alerts) and/or provide other international career information via email and, if applicable, social media (e.g. job offers, dates of job fairs, events, etc.). We use an email and social media campaign tool integrated with our Oracle HCM cloud-based system to send the aforementioned messages. In this tool we process your name, surname and e-mail address.

To improve our careers page and career information, we measure and analyse the reach and success of our emails in an anonymised form. We assess:

• pipeline growth, i.e. how many potential customers we generated and passed on to the sales team
• conversion rate, i.e. how many leads become customers
• the number of recipients who opened e-mails
• click-through rate, i.e. what percentage of recipients opened the e-mail and clicked on the link in the e-mail
• form conversion rate, i.e. the percentage of e-mail recipients who completed the form
• rejection rate, i.e. how many e-mails were not delivered
• unsubscribe rate, i.e. how many people unsubscribed from email notifications
• unique visitors, i.e. how many people visit the careers page
• returning visitors, i.e. how many people visited our careers page / website in a certain period of time
• page views, i.e. how many people visited our careers page / website
• search engine traffic, i.e. how many people arrived at our careers page / website using a search engine
• rejection rate, i.e. how many people visit the careers page / website and leave without taking further action
• links from other sites / backlinks, i.e. whether there are other websites redirecting to our site

Employees during internal recruitment and, if necessary, IT employees can access the above information and assessments as part of system maintenance. The cloud data centre is located in Frankfurt am Main, Germany.

You may withdraw your consent(s) at any time by clicking on the link below or by sending an e-mail to: praca@sew-eurodrive.pl

The processing of the data in question remains lawful until your consent is withdrawn (ex nunc effect).

If you withdraw your consent, the information we have to send and evaluate and e-mails are deleted and you no longer receive e-mails from us with job offers or other career-related information.

V.4. Applying for internships and work placements

We are glad to receive applications for internships and work placements. Your application data shall be processed in accordance with the principles as described here at all times, with the restriction that we shall not include you in our applicant pool. If your application for an internship or a work placement is unsuccessful, we shall delete your application documentation at the end of the quarter following the completion of the application process. The legal basis is Article 6(1)(1)(b) of the GDPR. VI. Your rights as a person whose personal data we process.

VI. Data protection information for visitors of SEW-EURODRIVE

We are pleased when you visit us on site - whether as a contact person of a company (such as a customer or supplier), as a prospective customer, applicant or employee from SEW- EURODRIVE Group locations around the world. In order to be able to quickly identify the respective location in the event of an accident in our plant facilities or in the company and business premises and to be able to track your visit to us, e.g., due to the assertion of claims for damages and to protect our business and trade secrets (processing purposes), we record the following information about you digitally in an internal IT visitor system.

For the purposes indicated above, we process:

• surname, name,
• company name together with an address,
• (business) telephone number (optional),
• (business) e-mail address (optional),
• contact person of SEW-EURODRIVE,
• date and time of arrival and departure.

The legal basis is Article 6(1)(f) of the GDPR. The above purposes of processing constitute our legitimate interests. We store the information about you that is registered in our internal visitor system for a period of three years.

VII. Data protection information on the processing of personal data in connection with trade fairs and other events

If you visit us at a trade fair or other networking event, we may exchange information about our products or about existing or future collaboration, or for the purpose of contacting each other for future business affairs, i.e. to initiate, carry out or conclude business.

Depending on the situation or specific case or depending on what information is provided to us, we may process the following data: name, surname, form of address, title, (business) telephone number, (business) e-mail address, content of e-mail / Messenger messages within our correspondence before, during or after the trade fair or event, name and address of the company, organisational department in which you work, your function within the company, industry.

We may also process the following information:

• Information contained on the business cards that we exchange or that you give us.

• Information taken from your (public) website or (public) social media profile.

• Your image/appearance as part of the photographs, sound recordings and videos made, if we make recordings during an event and subsequently publish them; the rules for processing photographs and videos are described in section VIII,

• Your data that has been recorded and documented in the completed survey; in addition to surname and contact details, these are primarily product and process responses, and if the visitor answers questions via tablet, the date and time of the survey completion is also recorded,

• The information that is recorded and documented in the conversation note. In addition to your name and contact details, this includes but is not limited to information about your industry, project planning, your visitor category (customer, OEM, potential customer, supplier, press, student, applicant, other service providers), main topics of the conversation, notes from the conversation, excerpts of your statements (original audio) from the conversation, your requested contact method (telephone, mail, e-mail, messenger), interest in advertising, your planned orders.

• Other information from our correspondence before, during and after the trade fair.

• Documentation / comment on the conversation note that you have objected to the processing and storage of your data in our IT systems and files.

If you are a new, existing or potential customer, the information you provide will be entered and processed in our Customer Relationship Management (CRM) system. The information is processed on the servers of SEW-EURODRIVE located in Bruchsal as well as in the cloud environment of external providers. For more information on external service providers, please see section III.1(a).

If you are a supplier, the information presented here shall be entered and managed in our supplier management system.

If you make contact with us on a professional level, i.e. in the course of your profession, at a trade fair or other event, the processing of your data takes place on the basis of Article 6 (1)(b) of the GDPR, i.e. in the context of activities aimed at concluding an agreement. This is because the processing of data involving, for example, the exchange of contact details, the initiation of a partnership/project, is necessary for the performance of activities with regard to both our contractors and our employees. In other cases, personal data is processed on the basis of Article 6 (1)(f) of the GDPR. Maintaining business relationships, initiating and executing transactions constitute our and your legitimate interests.

In certain circumstances, for promotional purposes, we create and publish photos, sound recordings and videos of events or trade fairs. We obtain your consent to publish a photo or video if the photo or recording focuses on a specific person (you are in the foreground). We also need to obtain your consent if we conduct an interview and then publish it or your statement (verbatim quotes) in the media. The legal basis for this is Article 6(1)(a) of the GDPR. If you are not in the foreground in the photo or recording and the photo or recording depicts a number of people, in such situations our legitimate interest in taking and publishing the photo or recording takes precedence. The legal basis in this situation is Article 6 (1)(f) of the GDPR. Please read our data protection information on the taking and publication of photographs, sound recordings and videos, which are indicated in section VIII of this policy.

If you participate in an on-site survey/questionnaire, we will obtain your consent in advance. The legal basis is then Art. 6(1)(a) of the GDPR.

The information is stored insofar and as long as is necessary to fulfil the aforementioned purposes and/or to comply with legal retention obligations.

If you are a customer or potential customer, we shall also process your data as described in section III.1. If you take part in an on-site survey, the data protection information in section III.3. also applies.

If we connect on a social network such as LinkedIn in connection with the event, the privacy policy of the social network in question must also be observed.

VIII. Data protection information for the creation and publication of photo, audio and video recordings as well as press and advertising texts

When attending one of our events or training courses or visiting our trade fair stand or any other type of personal contact, photographs, audio and video recordings may be taken and published in which, in addition to depicting the course of events and the people attending the event (training course, trade fair, etc.), you can be recognised - whether in the foreground of the event being registered or merely as one of many people. The registration can be carried out directly by us or through an external agency, with the purpose of promotion or employer branding. In individual cases, you may talk to us or we may ask you specifically about the particular event, our products or our cooperation, for example, and we may process and publish a quote or statement from you in a press release. In addition to your outward appearance (photograph and video recording), voice and language (video and sound recording), we may in certain circumstances also collect – depending on the situation – your name and surname, position in the company, e-mail address, phone number, for example, if we mention you in a press release, social media post or in an image caption. If you are the focus of the photographs/recordings, we will assign a tag ID to enable us to subsequently identify you on the photographs/recordings.

Depending on how and where photographs/recordings and press releases containing mentions of you are published, they can, as a rule, be viewed, listened to, recorded, analysed or reproduced by anyone in the world with access to a particular medium. Media include e.g. Internet, local, regional, supra-regional, global Internet and print media, printed advertising material such as brochures and flyers of SEW-EURODRIVE and the SEW-EURODRIVE Group companies, distributed on the Internet, in the mobile applications and blogs of SEW-EURODRIVE and on the Internet, in the mobile applications and blogs of the SEW-EURODRIVE Group companies, in regional supra-regional and international trade magazines, in local, regional and supra-regional radio and TV stations, in online magazines, on social media platforms, in digital media, on the websites/profiles of SEW-EURODRIVE and SEW-EURODRIVE Group companies, on social networks such as YouTube, Facebook, LinkedIn, Instagram and in SEW-EURODRIVE's internal media (e.g. on the SEW-EURODRIVE DriveNet global intranet, in newsletters and e-mail campaigns implemented by SEW-EURODRIVE and by SEW-EURODRIVE Group companies. If we publish images/recordings and press releases on our Facebook, YouTube, Twitter, Xing, LinkedIn or Instagram channels, all users of these social media platforms can access them. If we publish recordings on the radio and television, everyone who receives these channels can watch and listen to them.

If you are the focus of an image/recording and can be clearly and unambiguously recognized or heard and/or are mentioned by name in a press release/advertising text, for example, together with a quote and your position at the company and are published in the stated media, we will obtain your informed consent in advance. When we obtain your consent, we will also assign a tag ID. The purpose of this is to enable us to subsequently identify you in the images/recordings. At any time you may, on the basis of Article 7 section 3 of the GDPR, withdraw your consent without stating a reason, e.g. by sending an e-mail to rodo@sew-eurodrive.pl. The withdrawal of consent does not affect the lawfulness of the processing before the moment of withdrawal.

If you have granted us unlimited consent, we shall publish and save the press releases/advertising texts and images/recordings for an unlimited period of time. If you withdraw your consent within one month, we shall delete the images/recordings in which you alone are the focus. Passages in press releases/advertising texts in which you are specifically mentioned shall be deleted within one month provided that this is legally, technically and economically possible and reasonable for us.

If you are not in the foreground of the photo or recording and the photo or recording depicts a group of people, our legitimate interest (promotion, employer branding) in taking and publishing the recording may process and publish the aforementioned material on the basis of the controller's legitimate interest, i.e. under Article 6(1)(f) of the GDPR. You have the right to object to such processing, pursuant to Article 21(1) of the GDPR, at any time by sending an e-mail to rodo@sew-eurodrive.pl. If your objection is successful, we shall attempt to anonymise your image and voice in texts and/or photos/recordings by pixelising (image, photo, video) and/or distorting (voice, audio) and/or deleting text as soon as it is legally, technically and economically possible for us to do so.

However, it should be noted that we cannot exclude the possibility that press releases / advertising texts or photos / recordings published on the website with your consent or on the basis of our legitimate interest may continue to circulate on the Internet even after they have been deleted or anonymised (e.g. pixelised) by us or by media/portals for which we as SEW-EURODRIVE are responsible. We also cannot exclude the possibility that they may have been previously downloaded, copied and further processed by third parties in their original ‘uncensored’ state.

IX. Data Protection Information for the Use of Microsoft Teams as a Collaboration Platform

Microsoft Teams (hereinafter MS Teams) enables collaboration and communication through virtual teams and channels, message exchange via chat, use of presence information, file exchange and storage as well as web conferencing and voluntary recording of images and sound - e.g. for documentation, learning and training purposes.

As part of our use of MS Teams, we may process such information as: surname, name, user name, user ID / meeting ID, (business) e-mail address, if necessary (business) telephone number, date and content of chat messages and video calls, documents sent and shared via the platform, physical appearance and body language / posture (face, body, facial expression, gestures, body movements, gait, etc.), provided that the video camera has been activated and/or access to the video camera has been activated. profile picture, if used, spoken language, voice and speech, provided that access to the microphone has been activated and/or participants have spoken during the meeting, recording of the meeting (video and audio), provided that recording has been activated and consent has been given.

As part of the use of MS Teams, we may also process pseudonymised diagnostic data (metadata), i.e. information required for the operation of MS Teams as well as used for product improvement, e.g. information about the current version of MS Teams, operating system version, system crashes. This data is linked to a pseudonymised identifier, which Microsoft does not use to identify users. It is used, for example, to check whether a system crash occurred in one person (one identifier) or in 100 people (100 identifiers).

You can find here further data that Microsoft might process if you use MS Teams: Microsoft Teams – Privacy - Microsoft Teams | Microsoft Docs

If SEW-EURODRIVE employees or applicants use video conferencing for the purpose of (professional) correspondence and tasks, the processing is based on Article 6(1)(b) of the GDPR. If the performance of professional duties or the application for a position requires the transfer of data to third countries in many cases, the legal basis is Article 6(1)(b) of the GDPR together with Article 49(1)(b) of the GDPR.

If employees of SEW-EURODRIVE customers, suppliers, interested parties, other third parties or employees of a company belonging to the global SEW Group, for example, participate in a video conference, the data is processed so that they can perform their job and we can communicate with each other to establish, carry out or terminate the business. The legal basis is Article 6(1)(b) of the GDPR or Article 6(1)(f) of the GDPR (see section III.1 for more information). If, in many cases, there is a need to transfer and exchange data with third countries for the purpose of professional activities and correspondence, Article 49(1)(b) and (c) of the GDPR also apply.

If the video conference is to be recorded, e.g., to allow those who could not participate in the live event to view it afterwards or for learning and training purposes, SEW-EURODRIVE will obtain the consent of the users by recording the consent of the users/participants verbally or expressed by other actions at the beginning of the recording. The legal basis is Article 6(1)(a) of the GDPR as well as Article 49(1)(a) of the GDPR if the data is transferred to third countries.

Access to this information is granted to persons who, for example, participate in a videoconference and/or to whom a recording of the videoconference is available, as well as, if applicable, the employees of SEW-EURODRIVE and Microsoft Corporation and Microsoft Ireland Operations Ltd., to the extent that they are responsible for the provision and support of MS Teams.

MS Teams is cloud-based. We have entered into a data processing agreement with Microsoft. Microsoft's data centres are located in Amsterdam (Netherlands) or within the EU. Since the above-mentioned pseudonymized diagnostic data (metadata) could be transferred through and from you to Microsoft Corporation in the USA, EU standard contractual clauses have been concluded with Microsoft Corporation. Furthermore, Microsoft has adopted additional technical and organizational protective measures to safeguard data transfers from and to the USA. Moreover, Microsoft ensures that law enforcement authorities will not be granted access to the information described unless a law permits or expressly requires them to do so.

SEW-EURODRIVE does not delete contents and documents of the chats as well as the published contributions in teams and channels unless the users instruct SEW to delete these contents and documents. In addition, users can delete their content and documents in chats, channels and teams themselves.

If the MS Teams account is deleted, the associated account login data as well as the contents and documents of the account (document storage, e-mail inbox) shall be permanently deleted after 60-90 days in accordance with Microsoft Standards, unless further processing is required in individual cases to fulfil legal retention obligations/periods. SEW-EURODRIVE points out that even after the deletion of an individual account, the contents and documents of the chats as well as the contributions in the team rooms and channels shall continue to be available to the existing users with whom the departing person has exchanged via the platform in their individual storage.

If the users have consented to the creation and storage of a recording, the data shall be deleted within one month after withdrawal, unless SEW-EURODRIVE is legally obligated to further processing or the rights of third parties prevent the deletion of the entire recording, e.g. the rights of the other participants.

In all other respects, reference is made to the data protection information of MS Teams: Microsoft Teams – Privacy - Microsoft Teams | Microsoft Docs

X. Data protection information regarding the use of Cisco Webex

With Cisco Webex, we can discuss, talk, and conduct virtual meetings anywhere around the world, regardless of location, via video conference and chat. For this purpose, the following information from and/or about you is processed on the premises in our data centre and, in some cases, in the cloud data centres of the provider:

• surname, name
• user name, user ID
• business e-mail address and, if applicable, telephone number; if necessary, role in the company
• date and all textual content in video chat messages, such as files (type, name, size), (external) links, read confirmation (depending on configuration)
• the spoken conversation during the video conference
• external appearance (face, body)
• voice and language
• name of the end device, GPS data, IP address, operating system, MAC address, time zone, activity logs

In individual cases, it is possible that video conferences may be recorded, e.g. for learning and training purposes and/or for persons who cannot participate in the video conference live. We shall record only if all participants have given their consent (separately) prior to the recording. Such a consent is also recorded.

If you, as SEW employees, conduct a video conference to perform and complete your professional correspondence and tasks, or participate in such a conference as an applicant without the video conference being recorded, the processing is performed in accordance with Art. 6(1)(b) of the GDPR. If the professional activities or the application require data to be transferred to third countries in a number of cases, the legal basis is Art. 6(1)(b) of the GDPR in conjunction with Art. 49(1)(b) of the GDPR.

If you participate in a video conference as an employee of our customers, suppliers, interested parties, or other third parties or as an employee of a company belonging to the worldwide SEW-EURODRIVE Group, your data shall be processed so that you can perform your professional tasks at your employer and so that we can communicate with each other to establish, conduct, or terminate the business. The legal basis in this respect is Art. 6(1)(b) and Art. 6(1)(f) of the GDPR. If data must be transmitted and exchanged in third countries for the purpose of professional activities and correspondence in a series of cases, Art. 49(1)(b) and (c) of the GDPR are also relevant.

If the video conference is to be recorded, for example, to enable those who could not attend the live event to be aware of it later or for learning and training purposes, we shall obtain your informed consent prior to the recording. The legal basis is Art. 6(1)(a)(7) GDPR and Art. 49(1)(a) GDPR if the data is transferred to third countries.

Access to the data is granted to persons who participate in the video conference and/or who have access to the recording of the video conference, as well as SEW or Cisco employees, as long as and insofar as they are responsible for providing and supporting the video conference systems. We have concluded a data processing agreement with Cisco.

If we conduct video conferences via Cisco Webex, no data is ever transferred to insecure third countries. Cisco's data centres are located in Amsterdam and London. With regard to London (UK), the EU has decided that the UK has an appropriate level of data protection that corresponds to that of the EU. In the event that information is transferred to insecure non-EU countries or there is a possibility that national investigation authorities and secret services could have access to the information from the video conferences, we conclude standard contractual clauses and, if necessary, take additional technical and organizational measures to secure the data transfers. As a precaution, we have concluded the EU standard contractual clauses (2021/914) with Cisco.

The information shall be stored to the extent and for the duration necessary to fulfil the above-mentioned purposes and/or to comply with data retention obligations. If you have consented to the production and storage of the recording for a limited or unlimited period of time, we shall delete the data after the expiry of this period or within one month after your revocation, unless SEW is legally obliged to further processing or third-party rights are opposed to the deletion of the entire recording, e.g. the rights of the other participants. If we are unable to remove, for example, your voice and/or your external appearance from the recording, we shall make every effort to anonymise it through pixelisation (image) and/or distortion (voice), unless this is not legally, technically, and/or economically possible and/or reasonable for us.

XI. Video Surveillance Data Protection Information Notice

In order to protect visitors, employees and equipment from damage to life, limb, health, property and possessions caused by unauthorised third parties, we monitor the plant site as well as business and operating premises at designated locations by means of video cameras with video recordings. The following information may be processed here:

• exterior appearance (e.g., hair colour, eye colour, face shape, body, clothing, other visible exterior features, visual and walking aids);
• body language and posture (e.g., gait, facial expressions, gestures, agility).

Cameras do not record sound.

Access to the recordings is available to employees of the Facility Infrastructure Maintenance department, IT and the Management Board. As a rule, recordings are kept for a maximum of 90 days.

The video surveillance system records the number plates of vehicles entering and leaving the company's premises. Vehicle data is stored for a period of 3 months. In the case of a suspected serious breach of duty (under Labour Code or Civil Code), misdemeanour or a criminal act, the relevant managers, relevant employees of the legal and HR departments, members of the works council or the data protection officer can also access the recordings for the purpose of evaluation. In the event of a reasonable suspicion of a criminal offence, the recordings may be passed on to the relevant investigative authorities. In such cases, it is reasonable to store and process the recordings for a period of more than 90 days, i.e. until the case is clarified and concluded.

The legal basis is Article 6(1)(f) of the GDPR. Protection of persons and property (prevention and prosecution) represent our legitimate interests.

Article 6 (1)(b) of the GDPR, as well as the provisions of the Labour Code, also apply to employees of SEW-EURODRIVE.

XII. Your rights as the data subject

Every data subject is entitled to the following rights:

• Right of access (Article 15 of the GDPR)
• Right to rectification of incorrect data (Article 16 of the GDPR)
• Right to erasure (Article 17 of the GDPR)
• Right to restriction of processing of personal data (Article 18 of the GDPR)
• Right to data portability (Article 20 of the GDPR)
• Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR).

You can object to the processing of personal data for promotional purposes – including the analysis of customer data – or the dissemination to third-parties for promotional purposes at any time without providing a reason.

In addition, any data subject has a general right to object (cf. Article 21, section 1 of the GDPR) to processing for purposes based on the controller's legitimate interest, including profiling carried out on the basis of this provision. In this case, the objection to data processing must be justified. If the data is processed with your consent, you may revoke this consent at any time with immediate future effect. Revoking your consent does not affect the legality of the data processing that occurred with your consent until the time of revocation.

Update: 05/2024